Skip to main content
Glama

ForgeGuard MCP

ForgeGuard MCP is an open-source, local-first Model Context Protocol (MCP) server for controlled AI access to software projects.

It is designed for coding agents that need to inspect, modify, test, and resume work on projects without receiving unrestricted access to the entire machine.

Status: early development — 0.2.0-alpha.1.

What the current alpha does

  • persistently register project workspaces only below explicitly allowed roots

  • read, atomically write, and exactly patch guarded UTF-8 files

  • list bounded directory trees and search project text

  • block common sensitive files such as .env, private keys, PEM/key files, and credentials files

  • redact several common token/private-key patterns before returning content

  • reject lexical traversal and symlink escapes

  • run git status and git diff without a shell

  • optionally run explicitly allowlisted executables with shell: false

  • apply fail-closed per-project policies stored outside project workspaces

  • enforce mandatory test/build/analyze gates before transaction apply

  • maintain a structured local JSONL audit log without file bodies or command arguments

  • start isolated Git worktree transactions

  • edit, inspect, test, apply, or abort transaction changes without touching the original until apply

  • refuse transaction apply when the original repository has moved or become dirty

  • persist and recover valid active transactions after ForgeGuard restarts

  • reject recovered transaction records that do not match an authorized registered project/worktree

  • maintain a persistent Project Brain with project context, tasks, progress notes, and decisions

  • resume task state across ChatGPT/Codex/other MCP client sessions with task_resume

Related MCP server: Project Navigator MCP Server

Security defaults

ForgeGuard is intentionally fail-closed.

Important environment variables:

  • FORGEGUARD_ALLOWED_ROOTS: directories below which projects may be registered. Missing means project_register is denied.

  • FORGEGUARD_COMMANDS: comma-separated executables permitted through generic process tools. Empty by default.

  • FORGEGUARD_STATE_DIR: persistent ForgeGuard state directory. Defaults to ~/.forgeguard.

  • FORGEGUARD_MAX_OUTPUT_BYTES: maximum captured process output. Defaults to 1 MiB.

Generic process execution is disabled until the local user explicitly enables commands.

ForgeGuard is not yet an operating-system sandbox. An explicitly permitted executable or repository script can still access OS resources outside the workspace. Git worktree transactions isolate repository changes, not operating-system capabilities.

See SECURITY.md for the current security boundary.

Requirements

  • Node.js 20+

  • npm

  • Git for Git tools and transactions

Install

git clone https://github.com/KatoteshiKuka/forgeguard-mcp.git
cd forgeguard-mcp
npm install
npm run build

Configure allowed project roots

macOS / Linux

export FORGEGUARD_ALLOWED_ROOTS="$HOME/Projects"
npm start

Multiple roots use the operating-system path delimiter:

export FORGEGUARD_ALLOWED_ROOTS="$HOME/Projects:$HOME/Work"

Windows PowerShell

$env:FORGEGUARD_ALLOWED_ROOTS = "C:\Users\you\Projects"
npm start

Multiple Windows roots are separated with ;.

Optional command execution

process_run and transaction_process_run have no allowed commands by default.

export FORGEGUARD_COMMANDS="npm,flutter,dart"

Commands are spawned as an executable plus argv with shell: false. Shell chaining/substitution syntax is not interpreted by ForgeGuard itself.

Persistent state

By default ForgeGuard stores local state under:

~/.forgeguard/
├── projects.json
├── transactions.json
├── audit.jsonl
├── policies/
├── brain/
└── worktrees/

Override it with:

export FORGEGUARD_STATE_DIR="$HOME/.local/share/forgeguard"

Per-project policy and apply gates

After registering a project, call project_policy_get to see its effective policy and policy file path.

Example Node policy:

{
  "allowFileRead": true,
  "allowFileWrite": true,
  "allowGitRead": true,
  "allowProcessRun": true,
  "allowedCommands": ["npm"],
  "applyGates": [
    { "command": "npm", "args": ["test"], "timeoutMs": 180000 },
    { "command": "npm", "args": ["run", "build"], "timeoutMs": 180000 }
  ]
}

allowedCommands can only narrow the global FORGEGUARD_COMMANDS set. A project policy cannot grant a command that the local administrator did not enable globally.

If an apply gate exits non-zero, times out, or uses a non-authorized command, transaction_apply is refused and the original project remains unchanged. The transaction stays available for correction or abort.

See docs/policies.md.

MCP client configuration

After npm run build, configure an MCP client to launch the compiled server over stdio.

{
  "mcpServers": {
    "forgeguard": {
      "command": "node",
      "args": ["/absolute/path/to/forgeguard-mcp/dist/index.js"],
      "env": {
        "FORGEGUARD_ALLOWED_ROOTS": "/Users/you/Projects",
        "FORGEGUARD_COMMANDS": "npm,flutter,dart"
      }
    }
  }
}

Adapt the surrounding configuration format to the MCP client you use.

Current MCP tools

Projects and policy

  • project_register

  • project_list

  • project_info

  • project_policy_get

Filesystem

  • file_read

  • file_write

  • file_patch

  • directory_tree

  • code_search

Git

  • git_status

  • git_diff

Processes

  • process_run

Transactions

  • transaction_begin

  • transaction_list

  • transaction_status

  • transaction_diff

  • transaction_file_read

  • transaction_file_write

  • transaction_file_patch

  • transaction_process_run

  • transaction_apply

  • transaction_abort

Project Brain

  • project_context_get

  • project_context_set

  • task_create

  • task_list

  • task_get

  • task_update

  • task_resume

  • decision_add

  • decision_list

Audit

  • audit_recent

project_register
      ↓
task_create / task_resume
      ↓
transaction_begin
      ↓
inspect / edit / patch inside transaction
      ↓
transaction_process_run (optional manual checks)
      ↓
transaction_diff
      ↓
transaction_apply
      │
      ├── mandatory policy gates run
      ├── refuses if original repo changed or became dirty
      └── commit/cherry-pick + cleanup if everything passes
      ↓
task_update / decision_add

If ForgeGuard or the MCP client restarts while a valid transaction is open, ForgeGuard can recover it from local state after validating it against the registered project and managed worktree directory.

See docs/transactions.md and docs/project-brain.md.

Development

npm install
npm run build
npm test

The suite covers path traversal, symlink escape, sensitive-file handling, atomic writes, project persistence, per-project policy narrowing, apply gates, audit metadata, Project Brain concurrency/persistence, real Git worktree apply/abort/recovery, tampered recovery state, and real MCP stdio restart/handoff flows.

GitHub Actions runs build and tests on Node.js 20 and 22.

Roadmap

Next

  • named command profiles (test, analyze, build) with project stack detection

  • richer transaction diff/risk summaries

  • task-to-transaction linking and automatic progress checkpoints

  • project context compiler that selects task-relevant files/symbols/tests

  • safer process isolation using OS/container sandboxing

Later

  • remote device agent

  • multi-machine support

  • richer handoff between ChatGPT, Codex, IDE agents, and scheduled workers

  • code graph / symbol dependency index

  • optional local UI for approvals, audit, tasks, and active transactions

License

Apache License 2.0. See LICENSE.

Available Tools

11 tools
directory_treeA

List a bounded directory tree inside a registered workspace while hiding sensitive files.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo.
maxDepthNo
projectIdYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full behavioral disclosure burden. It discloses two useful behaviors: results are bounded and sensitive files are hidden. It does not mention output format, error behavior, path validation, or whether hidden files are silently omitted, so transparency is only partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one tightly written sentence with no filler. It front-loads the verb and object, and the qualifiers 'bounded' and 'hiding sensitive files' add meaningful value rather than wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With three parameters, zero schema description coverage, no annotations, and no output schema, the single sentence is not enough. An agent cannot tell how path and maxDepth interact, what a bounded tree looks like in the response, or how projectId maps to a registered workspace.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description needed to compensate by explaining projectId, path, and maxDepth. It does not explain any of them; 'bounded' only vaguely alludes to maxDepth. All parameter meaning falls back to names and schema constraints, which is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific operation: list a bounded directory tree inside a registered workspace. It also adds the distinguishing behavior of hiding sensitive files, which separates it from content-focused siblings like file_read, file_write, and code_search. This is clear and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'inside a registered workspace' gives contextual placement, and 'bounded directory tree' implies use for structural exploration rather than file content access. However, it does not name alternatives or explicitly state when not to use this tool, so usage guidance is mostly implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_patchA

Replace exactly one matching text block in a UTF-8 project file. Fails when the match is missing or ambiguous.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
newTextYes
oldTextYes
projectIdYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the matching behavior, the failure conditions for missing or ambiguous matches, and UTF-8 encoding. However, it does not mention side effects beyond replacement, such as whether the file is modified in place, whether permissions are needed, or what happens on success.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly packed sentence with no filler. It front-loads the core operation and includes the most important constraints and failure behavior efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for basic selection and invocation, but with no output schema and no annotations, an agent still lacks information about return values, whether oldText must be unique or can be a substring, and what constitutes success. The failure cases are covered, but the overall operational context is incomplete for a mutating tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the four parameters. It partially clarifies oldText/newText via 'matching text block' and 'Replace', but it does not explain projectId or path meaning, path scope, or the relationship between the parameters beyond the basic replace concept.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Replace'), a specific resource ('one matching text block in a UTF-8 project file'), and adds distinguishing constraints ('exactly one', fails on missing/ambiguous matches). This clearly differentiates file_patch from file_write and file_read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use this tool: when an exact, unique text replacement is needed in a project file. It does not explicitly name alternatives such as file_write for whole-file writes, but the 'exactly one matching text block' phrasing gives clear contextual guidance and the failure conditions reinforce the intended use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_readA

Read a UTF-8 file inside a registered workspace. Traversal, symlink escapes, sensitive files, and known secret patterns are guarded.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
projectIdYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It usefully discloses that traversal, symlink escapes, sensitive files, and secret patterns are guarded. However, 'guarded' is ambiguous—it does not specify whether such attempts result in an error, redaction, or empty content—and there is no mention of behavior for missing files or non-UTF-8 content.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The core action is front-loaded, and the security guardrails are stated compactly without redundant elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool, the description covers basic purpose and safety constraints, and the schema covers parameter types. Still, it omits behavior for guarded cases, errors, and return value shape, which an agent would need to fully predict invocation outcomes. It is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds meaning by implying projectId identifies a registered workspace and path refers to a file path within it. However, it does not clarify path format, whether paths are relative or absolute, or how projectId maps to the workspace beyond general inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Read'), a resource ('a UTF-8 file'), and a clear scope ('inside a registered workspace'). It is easily distinguished from siblings like file_write and file_patch, which are mutations, and from directory_tree or code_search, which serve different read purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'inside a registered workspace' implies the tool requires a valid projectId and is meant for reading files within that boundary. However, it does not explicitly say when to prefer this over directory_tree or code_search, nor does it state when not to use it, leaving usage guidance implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_writeA

Create or replace one UTF-8 file inside a registered workspace. Sensitive paths and symlink targets are rejected.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
contentYes
projectIdYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses destructive behavior ('replace'), the encoding contract ('UTF-8'), and important safety behavior ('Sensitive paths and symlink targets are rejected'). It omits some details like permission requirements and return values, but the key side effects are transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The core function is front-loaded, and the safety constraint is presented as a separate, easy-to-parse sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a write tool with no annotations, no output schema, and no schema-level parameter descriptions, the description is under-specified. An agent cannot tell what a successful call returns, how paths are resolved inside the workspace, or what qualifies as a 'sensitive path.' The basic operation is clear, but the operational context for reliable invocation is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description needed to add meaning to the parameters. It only indirectly covers them: 'registered workspace' implies projectId, 'UTF-8' relates to content, and path constraints are mentioned as sensitive/symlink rejections. It does not explain whether path is relative to the workspace root, whether directories are created, or how the 5MB content limit behaves.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action and object: 'Create or replace one UTF-8 file inside a registered workspace.' This distinguishes file_write from siblings like file_read, file_patch, and workspace-management tools by making full-file write/replace semantics explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is clear implied context: use this tool to create or replace full files in a registered workspace. However, it does not explicitly say when to prefer file_patch for partial edits or how to handle an unregistered workspace, so guidance is implied rather than made explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

git_diffB

Run a non-mutating git diff inside a registered project.

ParametersJSON Schema
NameRequiredDescriptionDefault
stagedNo
projectIdYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It explicitly says 'non-mutating', which is a critical safety trait for this read-only operation. However, it does not disclose output format, error behavior for an unregistered project, or how the staged flag affects which changes are diffed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. Every word earns its place, and the most important qualifier, 'non-mutating', appears before the resource name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters, no annotations, and no output schema, this one-sentence description is minimally callable but incomplete. It lacks staged semantics, return-value expectations, and any relationship to git_status, so an agent must rely on background git knowledge to fill gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the parameters. It adds that projectId must refer to a registered project, but it says nothing about the staged parameter, leaving the agent to infer its meaning from the boolean name and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Run') and resource ('git diff'), scoped to a registered project, and the 'non-mutating' qualifier distinguishes it from mutating sibling tools like file_patch. An agent can clearly tell this is the diff tool and not git_status just from the wording.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not-to-use guidance is provided. The sibling git_status is not mentioned, so the description does not help an agent choose between git_diff and git_status; the only contextual clue is the registered-project scope.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

git_statusA

Run git status --short inside a registered project without invoking a shell.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectIdYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It discloses that the tool does not invoke a shell, which is a meaningful execution trait, and specifies the short-format status output. It does not detail error behavior, but git status is a standard read-only operation and the command itself implies its behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence states the action, scope, and a key behavioral distinction with no wasted words. It is concise without losing necessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only Git status tool, the description plus schema is nearly sufficient for correct invocation. It lacks explicit return-format details and error handling, but '--short' already communicates the expected output style and the schema supplies the only required input.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, so the description must provide parameter meaning. It supplies the semantic anchor 'inside a registered project,' which maps to projectId, but it does not explicitly state that projectId is the identifier of the registered project or explain the UUID constraint. With only one parameter, the mapping is still inferable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific command and resource: 'Run git status --short inside a registered project.' This clearly states what the tool does and distinguishes it from related tools like git_diff or process_run.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear usage context: the command must run inside a registered project, and the tool is specifically a shell-free way to get git status. It does not explicitly name alternative tools or when not to use it, but the context is sufficient for an agent to choose it over running a shell command.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

process_runA

Run one explicitly allowlisted executable in a project workspace using argv directly (no shell). Disabled by default until FORGEGUARD_COMMANDS is configured.

ParametersJSON Schema
NameRequiredDescriptionDefault
argsNo
commandYes
projectIdYes
timeoutMsNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full transparency burden. It usefully discloses that execution bypasses the shell, that only explicitly allowlisted executables are permitted, and that the tool is disabled by default until configuration. It does not describe output behavior or side effects, but the security-relevant traits are well covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler. The core behavior is front-loaded, and the important operational constraint (disabled until configured) is placed at the end without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, the description covers the essential execution model, allowlist constraint, and configuration prerequisite. It lacks an explicit mention of return values or error behavior, and with no output schema the description could have added a bit more, but the critical calling context is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the four parameters. It explains 'command' as an allowlisted executable and 'args' through 'using argv directly', but leaves 'projectId' and 'timeoutMs' completely unaddressed. This is a meaningful gap, especially for projectId which is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Run'), a specific resource ('one explicitly allowlisted executable in a project workspace'), and the execution mode ('using argv directly, no shell'). This clearly distinguishes process_run from sibling file, project, and git tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: it runs only allowlisted executables and is disabled by default until FORGEGUARD_COMMANDS is configured. It does not explicitly name alternative tools or state when not to use it, but the unique execution role makes the intended use fairly unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

project_infoB

Get one registered project by id.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectIdYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosing behavior, but it only states 'Get one registered project by id.' It does not describe what happens when the projectId does not exist, whether 'registered' excludes certain projects, what fields the response contains, or any error behavior. For a tool with no annotations and no output schema, this is a notable transparency gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler: 'Get one registered project by id.' Every word contributes to conveying the action, object, and scoping. This is an excellent example of concise, well-structured tool documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple get-by-id tool with one required parameter, the description is enough to invoke the tool, but the absence of an output schema and behavioral details leaves gaps about the return format and error handling. An agent would need to make assumptions about what 'project info' contains and how failures are signaled. It is a minimal viable description rather than a fully complete one.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It does tie the single projectId parameter to the resource by saying 'by id,' and the schema already provides type, format, and pattern constraints. With only one self-explanatory parameter, this minimal linkage is adequate, though it could explicitly confirm that projectId refers to the registered project identifier.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get'), names the resource ('project'), and scopes it with 'one ... by id', which clearly differentiates it from the sibling project_list tool that presumably returns multiple projects. An agent can immediately understand this is a single-record lookup, not a listing or mutation operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus alternative siblings such as project_list or project_register. The phrase 'by id' implies a use case, but there are no exclusions, prerequisites, or alternative routing directions provided, leaving the agent to infer the intended context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

project_listA

List project workspaces registered for this ForgeGuard process.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden, but 'List' clearly conveys a non-mutating enumeration and the qualifier 'registered for this ForgeGuard process' defines the exact scope of the operation. It does not discuss output format or error cases, but for a zero-parameter read-only list tool the core behavior is sufficiently transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The entire description is a single front-loaded sentence with no filler. Every word contributes semantic content: action, object, and scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter tool, the description covers the necessary context: what is being listed and for which process. It could optionally describe the shape of the returned list, but since no output schema exists and this is a simple enumeration, the description is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is no parameter information for the description to add. The 100% schema coverage and empty properties object make the schema complete, satisfying the 0-param baseline of 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and a specific resource ('project workspaces registered for this ForgeGuard process'), making the tool's purpose unambiguous. The scope qualifier also distinguishes it from siblings such as project_register (creation) and project_info (single-item detail).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: 'List project workspaces' suggests this is the tool for enumerating all registered workspaces, while project_info/project_register are likely for single-project detail or registration. However, the description provides no explicit when-to-use or when-not-to-use guidance, so it offers only indirect routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

project_registerA

Register a project directory. The directory must be inside a locally configured allowed root.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
rootYes

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden of behavioral disclosure. It mentions a validation constraint (allowed root), but does not disclose what registration does, whether it is persistent, what side effects occur, or whether it fails if the project already exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. It front-loads the core action and then adds the key constraint, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and no parameter descriptions, this description is under-specified. It omits what happens after registration, what the 'name' parameter controls, and how 'root' interacts with the allowed-root restriction.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only loosely references 'directory' and 'allowed root'. It does not meaningfully explain the required 'root' parameter or the optional 'name' parameter, their relationship, or expected formats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Register') and a clear resource ('a project directory'), which clearly distinguishes this tool from the sibling read/utility tools like project_list and project_info. The required allowed-root constraint further clarifies the tool's scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for usage by stating that the directory must be inside a locally configured allowed root. It does not explicitly name alternatives or when-not-to-use conditions, but the tool's purpose is distinct enough among the siblings that the context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 11 tool updatesv0.1.0-alpha.1
    • First observedcode_search
    • First observeddirectory_tree
    • First observedfile_patch
    • First observedfile_read
    • First observedfile_write
    • First observedgit_diff
    • First observedgit_status
    • First observedprocess_run
    • First observedproject_info
    • First observedproject_list
    • First observedproject_register

TDQS

A3.7/5.0

Scored across 11 tools

Disambiguation5/5

Each tool maps to a distinct operation and resource type: workspace registration, file read/write/patch, git read-only inspection, directory/search, and process execution. Even potentially similar tools like file_patch and file_write are clearly separated by exact-match replacement versus full-file write.

Naming Consistency3/5

All names use lowercase underscores, but the convention is mixed: some are verb-final like file_read and process_run, while others are noun compounds like git_status, directory_tree, and code_search. This is readable but not as predictable as a uniform verb_noun pattern.

Tool Count5/5

Eleven tools is well-scoped for a secure file/git/process workspace server. Each tool has a distinct purpose, and none feel redundant or unnecessary.

Completeness4/5

The core workflows of registering workspaces, reading/writing/patching files, searching, and inspecting git state are covered. Minor gaps like no project unregister or file deletion are workable but not fatal for typical guarded agent tasks.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Provides secure, sandboxed file system access for AI assistants to read, write, and manage project files with controlled command execution capabilities, all confined to a designated workspace directory.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables ChatGPT or any MCP client to operate safely on a designated workspace by listing, reading, searching, writing, and trashing files, inspecting Git status/log/diff, and optionally running allowlisted executables without a shell.
    Apache 2.0
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables coding agents to perform workspace-confined file operations, read-only Git inspection, and structured shell commands, while requiring out-of-band human approval for mutations and external executions and maintaining an audit trail.
    3
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/KatoteshiKuka/forgeguard-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server